Add a deterministic hello-DRS protected tool-server demo

[OkeyAmy]

Problem

The current examples prove that DRS can be wired into real agentic flows, but they are not the first-run path we should send people to. A first usable product needs a deterministic demo with no external LLM or API key.

What to do

Add one repo-owned demo that proves the core wedge:

• issue a delegation with @okeyamy/drs-sdk
• call a protected HTTP or MCP-style tool server
• verify with drs-verify
• execute only after valid === true and binding === "match"

Acceptance criteria

• no external LLM or API key required
• one command starts the verifier and demo service
• one valid call succeeds
• one replay is rejected
• one unauthorized tool or policy violation is rejected
• one body-binding mismatch is rejected
• README output is short enough for a new builder to understand in five minutes

Out of scope

• web UI
• plugin integrations
• multi-agent orchestration beyond what the demo needs